@wrongstack/acp 0.276.4 → 0.277.0

package/dist/index.js

@@ -6,6 +6,32 @@ import * as fsp from 'fs/promises';
 import * as path from 'path';
 import { spawn } from 'child_process';
 
+// src/agent/stdio-transport.ts
+
+// src/win32-cmd.ts
+var WIN32_CMD_META = /[&|<>"\r\n\0]/;
+function buildWin32CmdShimInvocation(command, args = []) {
+  assertSafeWin32CmdArgs([command, ...args]);
+  const line = ["call", quoteWin32CmdArg(command), ...args.map(quoteWin32CmdArg)].join(" ");
+  return {
+    command: process.env["COMSPEC"] ?? "cmd.exe",
+    args: ["/d", "/c", line],
+    windowsVerbatimArguments: true
+  };
+}
+function assertSafeWin32CmdArgs(args) {
+  for (const arg of args) {
+    if (typeof arg === "string" && WIN32_CMD_META.test(arg)) {
+      throw new Error(
+        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
+      );
+    }
+  }
+}
+function quoteWin32CmdArg(arg) {
+  return `"${arg}"`;
+}
+
 // src/agent/stdio-transport.ts
 var StdioTransport = class {
   stdin = process.stdin;
@@ -125,19 +151,14 @@ var ClientTransport = class {
       const isPkgLauncher = this.opts.command === "npx" || this.opts.command === "uvx";
       const spawnCwd = isPkgLauncher ? os.homedir() : this.opts.cwd;
       try {
-        this.child = spawn3(this.opts.command, this.opts.args ?? [], {
+        const childArgs = this.opts.args ?? [];
+        const shim = process.platform === "win32" ? buildWin32CmdShimInvocation(this.opts.command, childArgs) : null;
+        this.child = spawn3(shim?.command ?? this.opts.command, shim?.args ?? childArgs, {
           env: { ...buildChildEnv(), ...this.opts.env },
           cwd: spawnCwd,
           stdio: ["pipe", "pipe", "pipe"],
           windowsHide: true,
-          // On Windows, most ACP-supporting tools (claude, gemini, codex,
-          // qwen, copilot) are installed as `.cmd` shims under
-          // AppData\Roaming\npm\. Node's spawn won't find them via
-          // `shell: false` because the .cmd extension is not in the
-          // default PATHEXT lookup. The argv here is always from our
-          // own static catalog or from a hardcoded spec, never from
-          // user input, so shell-expansion is bounded.
-          shell: process.platform === "win32"
+          ...shim ? { windowsVerbatimArguments: shim.windowsVerbatimArguments } : {}
         });
       } catch (err) {
         clearTimeout(timeout);
@@ -3209,16 +3230,12 @@ async function defaultProbe(desc, timeoutMs) {
     };
     let child;
     try {
-      child = spawn(desc.probe.command, [...desc.probe.args ?? []], {
+      const probeArgs = [...desc.probe.args ?? []];
+      const shim = process.platform === "win32" ? buildWin32CmdShimInvocation(desc.probe.command, probeArgs) : null;
+      child = spawn(shim?.command ?? desc.probe.command, shim?.args ?? probeArgs, {
         stdio: ["ignore", "pipe", "pipe"],
         windowsHide: true,
-        // On Windows, `claude`, `gemini`, `npx`, etc. are typically
-        // installed as `.cmd` shims under AppData\Roaming\npm\. Node's
-        // spawn() will not find them without shell-mode unless the
-        // extension is present. `shell: true` resolves this for the
-        // common case. The probe argv is always from our static
-        // catalog, never user input, so shell-expansion is bounded.
-        shell: process.platform === "win32"
+        ...shim ? { windowsVerbatimArguments: shim.windowsVerbatimArguments } : {}
       });
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);